Postgres, nodejs SELECT query

Question

I have a sqlquery which is: client.query("SELECT * FROM my_table WHERE my_varchar='userInput'").

userInput = req.body.userInput which reads from an inputbox in a jade file.

No matter what I try with different '' or "" around the variables I either get that it generates an error from every input or every input seems correct, although that input does not exist in the table.

Any help would be appreciated!

bknights · Accepted Answer · 2017-02-21 16:29:41Z

3

The normal answer is don't do that! Inserting raw user input is a great way to get hacked. Do you actually have an input value?

instead:

console.log("User Input is "+ userInput); // or add debug lib and debug("User Input....
client.query("SELECT * FROM my_table WHERE my_varchar = $1", [userInput]);

Also validate your query in psql from a command prompt

edited Feb 21, 2017 at 16:29

answered Feb 20, 2017 at 19:58

bknights

15.6k2 gold badges20 silver badges35 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Ludvig Knutsmark Over a year ago

I tried that, but I still get the same problem, wrong inputs is seen as correct.

bknights Over a year ago

Please see revised advice.

Collectives™ on Stack Overflow

Postgres, nodejs SELECT query

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related